build(deps): bump the codeql-actions group with 2 updates

Bumps the codeql-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...f205ea1c3313d32999d8d6a48b4f6530d4437b38)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.37.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/codeql.yml

@@ -35,12 +35,12 @@ jobs:
           node-version: ${{ env.NODE_VERSION }}
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: javascript-typescript
           build-mode: none
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:javascript-typescript"

__tests__/dockerhub.test.ts

@@ -5,7 +5,6 @@ import {beforeEach, describe, expect, test, vi} from 'vitest';
 import * as dockerhub from '../src/dockerhub.js';
 
 vi.mock('@actions/core', () => ({
-  debug: vi.fn(),
   getIDToken: vi.fn(),
   info: vi.fn(),
   setSecret: vi.fn()
@@ -84,15 +83,6 @@ describe('getOIDCToken', () => {
     expect(body.get('connection_id')).toBe(validConnectionID);
     expect(body.get('expires_in')).toBe('300');
     expect(setSecretMock).toHaveBeenCalledWith('hub-token');
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC detected for docker.io');
-    expect(core.info).toHaveBeenCalledWith('Retrieving GitHub OIDC token for Docker Hub');
-    expect(core.info).toHaveBeenCalledWith('Exchanging GitHub OIDC token for Docker Hub token');
-    expect(core.info).toHaveBeenCalledWith('Docker Hub OIDC token exchange succeeded');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token audience: https://identity.docker.com');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token expiration: 300s');
-    expect(core.debug).toHaveBeenCalledWith('Sending Docker Hub OIDC token request to https://identity.docker.com/oauth/token');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token request returned status code 200');
-    expect(core.debug).toHaveBeenCalledWith('Docker Hub OIDC token response status code: 200');
   });
 
   test('uses custom token expiration', async () => {

src/dockerhub.ts

@@ -35,10 +35,6 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   const expiresIn = getExpiresIn();
   const identityHost = registry === 'registry-1-stage.docker.io' ? 'identity-stage.docker.com' : 'identity.docker.com';
   const audience = `https://${identityHost}`;
-  core.info(`Docker Hub OIDC detected for ${registry || 'docker.io'}`);
-  core.debug(`Docker Hub OIDC token audience: ${audience}`);
-  core.debug(`Docker Hub OIDC token expiration: ${expiresIn}s`);
-  core.info(`Retrieving GitHub OIDC token for Docker Hub`);
   const idToken = await core.getIDToken(audience);
   const http: httpm.HttpClient = new httpm.HttpClient('github.com/docker/login-action', [], {
     headers: {
@@ -53,12 +49,10 @@ export const getOIDCToken = async (registry: string, username: string): Promise<
   data.set('connection_id', connectionID);
   data.set('expires_in', expiresIn.toString());
 
-  core.info(`Exchanging GitHub OIDC token for Docker Hub token`);
   const resp = await postWithRetry(http, `https://${identityHost}/oauth/token`, data.toString());
 
   const tokenResp = <OIDCTokenResponse>JSON.parse(await handleResponse(resp));
   core.setSecret(tokenResp.access_token);
-  core.info(`Docker Hub OIDC token exchange succeeded`);
 
   return {
     username,
@@ -76,20 +70,16 @@ const getExpiresIn = (): number => {
 };
 
 const postWithRetry = async (http: httpm.HttpClient, url: string, data: string): Promise<httpm.HttpClientResponse> => {
-  core.debug(`Sending Docker Hub OIDC token request to ${url}`);
   let resp = await http.post(url, data);
-  core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   for (let attempt = 0; (resp.message.statusCode || HttpCodes.InternalServerError) === HttpCodes.TooManyRequests && attempt < maxRetries; attempt++) {
     const delay = parseRetryAfter(resp.message.headers['retry-after']);
     if (delay === null) {
-      core.debug(`Docker Hub OIDC token request rate limited without retry-after header`);
       break;
     }
     await resp.readBody();
     core.info(`Docker Hub OIDC token request rate limited, retrying in ${delay}ms (attempt ${attempt + 1}/${maxRetries})`);
     await new Promise(resolve => setTimeout(resolve, delay));
     resp = await http.post(url, data);
-    core.debug(`Docker Hub OIDC token request returned status code ${resp.message.statusCode || HttpCodes.InternalServerError}`);
   }
   return resp;
 };
@@ -111,7 +101,6 @@ const parseRetryAfter = (value: string | string[] | undefined): number | null =>
 const handleResponse = async (resp: httpm.HttpClientResponse): Promise<string> => {
   const body = await resp.readBody();
   const statusCode = resp.message.statusCode || HttpCodes.InternalServerError;
-  core.debug(`Docker Hub OIDC token response status code: ${statusCode}`);
   if (statusCode < HttpCodes.OK || statusCode >= HttpCodes.MultipleChoices) {
     throw parseError(statusCode, body);
   }